Feature: Parity on bypass auto-accept tier — --dangerously-skip-permissions, sandbox-gate relaxation, and defaultMode persistence (Shift+Tab toggle already exists)

Summary

OpenClaude already has a working in-session permission-mode toggle: Shift+Tab cycles modes (see web/src/data/keybindings.ts, src/utils/permissions/getNextPermissionMode.ts), including an Auto mode with an opt-in dialog (src/components/AutoModeOptInDialog.tsx — "Shift+Tab to change mode"). The modes live in src/utils/permissions/PermissionMode.ts and src/types/permissions.ts.

However, the full auto-accept / bypass tier is hard-gated to a no-internet sandbox (see closed #20). There is no --dangerously-skip-permissions / bypassPermissions entry path that the user can opt into outside that sandbox, and there is no permissions.defaultMode user-level persistence equivalent to Claude Code's.

This issue is not asking for the Shift+Tab toggle (it exists) — it is asking for parity on the bypass auto-accept tier and how a user opts into it.

Current OpenClaude state (verified in code)

• ✅ Shift+Tab cycles permission modes in-session.
• ✅ Auto mode exists (background classifier safety check; opt-in dialog).
• ❌ bypassPermissions / full auto-accept only available inside a no-internet sandbox.
• ❌ No --dangerously-skip-permissions CLI flag to opt into bypass on launch.
• ❌ No user-scoped permissions.defaultMode persistence for the chosen mode across sessions.

Target behavior (Claude Code parity)

1. Bypass flag: add --dangerously-skip-permissions (alias --permission-mode bypassPermissions) that enables full auto-accept on launch without requiring a gated sandbox.
2. Relax sandbox gate for opt-in bypass: when the user explicitly launches with the flag (or sets user-scoped default mode), surface a clear one-time safety warning instead of silently gating bypass to no-internet sandboxes.
3. Persistence: support permissions.defaultMode in user-scoped settings (e.g. ~/.openclaude/settings.json) so the chosen mode survives restarts.
4. Safety carve-outs preserved in bypass: permissions.ask rules still force a prompt; circuit-breaker for destructive commands (e.g. rm -rf /, rm -rf ~) still prompts; MCP tools flagged requiresUserInteraction still prompt.

Why this matters

Local-model / trusted-environment users (the exact audience raised in #20) want unattended operation without sitting through approval prompts every few minutes, and without being forced into a restrictive no-internet sandbox. Claude Code demonstrates this can be safely exposed via an explicit flag + user-level default.

Proposed scope

• Add the --dangerously-skip-permissions / --permission-mode CLI flags.
• Make Shift+Tab reachable to bypassPermissions when opted in via flag or user settings (currently sandbox-gated).
• Add permissions.defaultMode user-scope persistence.
• Document the modes, the flag, and the safety carve-outs.

Related

• Supersedes the UX portion of closed #20 (auto-accept for local models).
• Related: #251 (auto accept edits still prompting), #1097 (bypassPermissions still prompts for .git writes).
• Code refs: web/src/data/keybindings.ts, src/utils/permissions/getNextPermissionMode.ts, src/components/AutoModeOptInDialog.tsx, src/utils/permissions/PermissionMode.ts.